@axa-fr/oidc-client-service-worker 7.29.7 → 7.30.0

package/src/jwt.ts

@@ -208,11 +208,14 @@ export const generateJwtDemonstratingProofOfPossessionAsync =
   (w: any) =>
   (demonstratingProofOfPossessionConfiguration: DemonstratingProofOfPossessionConfiguration) =>
   async (jwk: any, method = 'POST', url: string, extrasClaims = {}) => {
+    const target = new URL(url, w.location?.href);
+    target.search = '';
+    target.hash = '';
     const claims = {
       // https://www.rfc-editor.org/rfc/rfc9449.html#name-concept
       jti: btoa(w.crypto.randomUUID()),
       htm: method,
-      htu: url,
+      htu: target.href,
       iat: Math.round(Date.now() / 1000),
       ...extrasClaims,
     };

package/src/oidcConfig.ts

@@ -1,4 +1,5 @@
 import { acceptAnyDomainToken } from './constants';
+import { getTokenContexts } from './tokenContexts';
 import { Database, Domain, OidcConfig, OidcServerConfiguration, TrustedDomains } from './types';
 import { getDomains, normalizeUrl } from './utils';
 
@@ -83,7 +84,7 @@ const shouldBypassNonOidcRequest = (
 
 const getMatchingOidcConfigurations = (database: Database, url: string): OidcConfig[] => {
   const normalizedUrl = normalizeUrl(url);
-  return Object.values(database).filter(config => {
+  return getTokenContexts(database).filter(config => {
     const { oidcServerConfiguration } = config || {};
     const { tokenEndpoint, revocationEndpoint } = oidcServerConfiguration || {};
 

package/src/protocol.ts

@@ -37,7 +37,18 @@ export type {
  * - The `PATCH` component changes for documentation or non-behavioural
  *   tweaks.
  */
-export const PROTOCOL_VERSION = '1.0.0' as const;
+export const PROTOCOL_VERSION = '1.1.0' as const;
+
+export type { OidcResourceConfiguration } from './resource';
+export {
+  getContextResource,
+  getResourceConfiguration,
+  getResourceContextName,
+  isResourceOriginManaged,
+  isResourceUrlAllowed,
+  RESOURCE_TOKEN_REQUEST_HEADER,
+  validateResourceIdentifier,
+} from './resource';
 
 /**
  * Every supported service worker message type.
@@ -97,6 +108,10 @@ export interface ServiceWorkerMessage<
  * extend it with additional, well-known fields (see PROTOCOL.md).
  */
 export interface ServiceWorkerResponse {
+  /** Resource isolation capability provided by protocol 1.1 workers. */
+  resourceTokenManagement?: boolean;
+  /** Worker-owned context names, without token or key material. */
+  resourceContexts?: string[];
   configurationName?: string;
   /** Set by the SW when it cannot service the request. */
   error?: unknown;

package/src/resource.ts

@@ -0,0 +1,104 @@
+/** An explicitly permitted OAuth resource and its API destinations. */
+export interface OidcResourceConfiguration {
+  resource: string;
+  allowedUrlPrefixes: readonly string[];
+  scope?: string;
+  audiences?: readonly string[];
+}
+
+/** Worker-only resource refresh routing hint, removed before the provider request. */
+export const RESOURCE_TOKEN_REQUEST_HEADER = 'x-oidc-resource';
+
+/** Builds an isolated storage/worker context without creating another OIDC client. */
+export const getResourceContextName = (configurationName: string, resource: string): string =>
+  `${configurationName}#resource=${encodeURIComponent(resource)}`;
+
+/** Reads the exact resource identifier from an isolated context name. */
+export const getContextResource = (configurationName: string): string | undefined => {
+  const marker = '#resource=';
+  const index = configurationName.indexOf(marker);
+  return index < 0 ? undefined : decodeURIComponent(configurationName.slice(index + marker.length));
+};
+
+/** Validates RFC 8707 identifiers without treating them as API URLs or scopes. */
+export const validateResourceIdentifier = (resource: string): void => {
+  if (
+    typeof resource !== 'string' ||
+    !/^[a-z][a-z\d+.-]*:/i.test(resource) ||
+    resource.includes('#') ||
+    /\s/.test(resource)
+  ) {
+    throw new Error('A resource must be an absolute URI without whitespace or a fragment.');
+  }
+  new URL(resource);
+};
+
+const getApiUrl = (value: string): URL => {
+  const url = new URL(value);
+  if (
+    (url.protocol !== 'https:' && url.protocol !== 'http:') ||
+    url.username ||
+    url.password ||
+    url.hash ||
+    /%2f|%5c/i.test(url.pathname)
+  ) {
+    throw new Error(
+      'API destinations must be HTTP(S) URLs without credentials, fragments, or encoded separators.',
+    );
+  }
+  return url;
+};
+
+const getApiPrefixUrl = (value: string): URL => {
+  const prefix = getApiUrl(value);
+  if (prefix.search) throw new Error('An API URL prefix must not contain a query.');
+  return prefix;
+};
+
+/** Prevents default-token fallback anywhere on an explicitly managed API origin. */
+export const isResourceOriginManaged = (
+  configurations: readonly OidcResourceConfiguration[] | undefined,
+  destination: string,
+): boolean => {
+  const origin = getApiUrl(destination).origin;
+  return (
+    configurations?.some(configuration =>
+      configuration.allowedUrlPrefixes.some(value => getApiPrefixUrl(value).origin === origin),
+    ) ?? false
+  );
+};
+
+/** Matches API mappings by parsed origin and path boundaries, never by host suffix. */
+export const isResourceUrlAllowed = (
+  configuration: OidcResourceConfiguration,
+  destination: string,
+): boolean => {
+  const url = getApiUrl(destination);
+  return configuration.allowedUrlPrefixes.some(value => {
+    const prefix = getApiPrefixUrl(value);
+    const path = prefix.pathname.replace(/\/+$/, '');
+    return (
+      url.origin === prefix.origin &&
+      (path === '' || url.pathname === path || url.pathname.startsWith(`${path}/`))
+    );
+  });
+};
+
+/** Validates and retrieves an explicitly registered resource. */
+export const getResourceConfiguration = (
+  configurations: readonly OidcResourceConfiguration[] | undefined,
+  resource: string,
+): OidcResourceConfiguration => {
+  validateResourceIdentifier(resource);
+  const matches =
+    configurations?.filter(configuration => configuration.resource === resource) ?? [];
+  if (matches.length !== 1 || matches[0].allowedUrlPrefixes.length === 0) {
+    throw new Error(
+      'The resource must be registered exactly once with permitted API URL prefixes.',
+    );
+  }
+  for (const prefix of matches[0].allowedUrlPrefixes) {
+    isResourceUrlAllowed(matches[0], prefix);
+  }
+  return matches[0];
+};

package/src/tokenContexts.ts

@@ -0,0 +1,39 @@
+import { getResourceConfiguration, getResourceContextName } from './resource';
+import type { Database, OidcConfig } from './types';
+
+export const getTokenContextEntries = (database: Database): Array<[string, OidcConfig]> =>
+  Object.entries(database).flatMap(([key, configuration]): Array<[string, OidcConfig]> => [
+    [key, configuration],
+    ...Object.entries(configuration.resourceEntries ?? {}),
+  ]);
+
+export const getTokenContexts = (database: Database): OidcConfig[] =>
+  getTokenContextEntries(database).map(([, configuration]) => configuration);
+
+export const getOrCreateResourceContext = (
+  configuration: OidcConfig,
+  resource: string,
+): OidcConfig => {
+  getResourceConfiguration(configuration.oidcConfiguration?.resources, resource);
+  configuration.resourceEntries ??= {};
+  const name = getResourceContextName(configuration.configurationName, resource);
+  configuration.resourceEntries[name] ??= {
+    ...configuration,
+    configurationName: name,
+    resource,
+    parentConfiguration: configuration,
+    resourceEntries: undefined,
+    authorizationScope: undefined,
+    requestedScope: undefined,
+    demonstratingProofOfPossessionApiNonce: null,
+    refreshGrant: undefined,
+    tokens: null,
+    state: null,
+    codeVerifier: null,
+    nonce: null,
+    status: null,
+    hideAccessToken: true,
+    generation: 0,
+  };
+  return configuration.resourceEntries[name];
+};

package/src/types.ts

@@ -1,3 +1,5 @@
+import type { OidcResourceConfiguration } from './resource';
+
 export type DomainDetails = {
   domains?: Domain[];
   oidcDomains?: Domain[];
@@ -42,6 +44,10 @@ export type OidcServerConfiguration = {
 export type OidcConfiguration = {
   token_renew_mode: string;
   demonstrating_proof_of_possession: boolean;
+  client_id?: string;
+  scope?: string;
+  resource?: string | readonly string[];
+  resources?: readonly OidcResourceConfiguration[];
 };
 
 export type Status =
@@ -95,6 +101,14 @@ export type Nonce = {
 } | null;
 
 export type OidcConfig = {
+  authorizationScope?: string;
+  requestedScope?: string;
+  demonstratingProofOfPossessionApiNonce?: string | null;
+  parentConfiguration?: OidcConfig;
+  resource?: string;
+  resourceEntries?: Record<string, OidcConfig>;
+  refreshGrant?: OidcConfig;
+  generation?: number;
   demonstratingProofOfPossessionConfiguration: DemonstratingProofOfPossessionConfiguration | null;
   configurationName: string;
   tokens: Tokens | null;
@@ -117,6 +131,7 @@ export type OidcConfig = {
 };
 
 export type IdTokenPayload = {
+  sub?: string;
   iss: string;
   /**
    * (Expiration Time) Claim
@@ -130,17 +145,28 @@ export type IdTokenPayload = {
 };
 
 export type AccessTokenPayload = {
+  aud?: string | string[];
+  iss?: string;
   exp: number;
   sub: string;
   iat: number;
 };
 
 export type Tokens = {
+  scope?: string;
+  resourceContext?: {
+    resource: string;
+    issuer: string;
+    clientId: string;
+    configurationName: string;
+    subject: string;
+    grantResource: string | null;
+  };
   issued_at: number | string;
   access_token: string;
   accessTokenPayload: AccessTokenPayload | null;
   id_token: null | string;
-  idTokenPayload: IdTokenPayload;
+  idTokenPayload?: IdTokenPayload | null;
   refresh_token?: string;
   expiresAt: number;
   expires_in: number | string;

package/src/utils/domains.ts

@@ -1,5 +1,11 @@
 import { acceptAnyDomainToken, openidWellknownUrlEndWith, scriptFilename } from '../constants';
-import { Database, Domain, DomainDetails, OidcConfig, TrustedDomains } from '../types';
+import {
+  getResourceConfiguration,
+  isResourceOriginManaged,
+  isResourceUrlAllowed,
+} from '../resource';
+import { getTokenContextEntries } from '../tokenContexts';
+import { Database, Domain, DomainDetails, TrustedDomains } from '../types';
 import { normalizeUrl } from './normalizeUrl';
 
 export function checkDomain(domains: Domain[], endpoint: string) {
@@ -45,8 +51,20 @@ export const getCurrentDatabaseDomain = (
     return null;
   }
   const datatases = [];
-  for (const [key, currentDatabase] of Object.entries<OidcConfig>(database)) {
+  for (const [key, currentDatabase] of getTokenContextEntries(database)) {
     const oidcServerConfiguration = currentDatabase.oidcServerConfiguration;
+    const resources = currentDatabase.oidcConfiguration?.resources;
+    if (currentDatabase.resource) {
+      if (!isResourceUrlAllowed(getResourceConfiguration(resources, currentDatabase.resource), url))
+        continue;
+    } else if (
+      resources?.length &&
+      (!oidcServerConfiguration?.userInfoEndpoint ||
+        url !== normalizeUrl(oidcServerConfiguration.userInfoEndpoint)) &&
+      isResourceOriginManaged(resources, url)
+    ) {
+      continue;
+    }
 
     if (!oidcServerConfiguration) {
       continue;

package/src/utils/tokens.ts

@@ -1,5 +1,6 @@
 /* eslint-disable simple-import-sort/exports */
 import { TOKEN, TokenRenewMode } from '../constants';
+import { getResourceConfiguration } from '../resource';
 import {
   AccessTokenPayload,
   IdTokenPayload,
@@ -120,7 +121,20 @@ function _hideTokens(
   tokens: Tokens,
   currentDatabaseElement: OidcConfig,
   configurationName: string,
+  isAuthorizationCode = false,
 ) {
+  const hasNewIdToken = typeof tokens.id_token === 'string' && tokens.id_token.length > 0;
+  const parent = currentDatabaseElement.parentConfiguration;
+  if (
+    currentDatabaseElement.resource &&
+    currentDatabaseElement.refreshGrant === currentDatabaseElement &&
+    tokens.refresh_token &&
+    tokens.refresh_token === parent?.tokens?.refresh_token
+  ) {
+    throw new Error(
+      'The provider reused a refresh token across separate authorization transactions; use a multi-resource authorization grant instead.',
+    );
+  }
   if (!tokens.issued_at) {
     const currentTimeUnixSecond = new Date().getTime() / 1000;
     tokens.issued_at = currentTimeUnixSecond;
@@ -129,6 +143,15 @@ function _hideTokens(
   }
 
   const accessTokenPayload = extractTokenPayload(tokens.access_token);
+  if (
+    currentDatabaseElement.resource ||
+    currentDatabaseElement.oidcConfiguration?.resources?.length
+  ) {
+    tokens.scope ??=
+      currentDatabaseElement.requestedScope ??
+      currentDatabaseElement.tokens?.scope ??
+      currentDatabaseElement.oidcConfiguration?.scope;
+  }
   const secureTokens = {
     ...tokens,
     accessTokenPayload,
@@ -156,10 +179,24 @@ function _hideTokens(
       const keyNonce = `${TOKEN.NONCE_TOKEN}_${currentDatabaseElement.configurationName}`;
       _idTokenPayload.nonce = keyNonce;
     }
-    secureTokens.idTokenPayload = _idTokenPayload;
+    secureTokens.idTokenPayload =
+      currentDatabaseElement.resource && !hasNewIdToken ? null : _idTokenPayload;
+  }
+  if (
+    currentDatabaseElement.resource &&
+    isAuthorizationCode &&
+    (!hasNewIdToken ||
+      typeof tokens.idTokenPayload?.sub !== 'string' ||
+      !tokens.idTokenPayload.sub ||
+      (currentDatabaseElement.nonce &&
+        tokens.idTokenPayload.nonce !== currentDatabaseElement.nonce.nonce))
+  ) {
+    throw new Error(
+      'Resource authorization requires a fresh ID token with the expected subject and nonce.',
+    );
   }
   if (tokens.refresh_token) {
-    secureTokens.refresh_token = `${TOKEN.REFRESH_TOKEN}_${configurationName}`;
+    secureTokens.refresh_token = `${TOKEN.REFRESH_TOKEN}_${(currentDatabaseElement.refreshGrant ?? currentDatabaseElement).configurationName}`;
   }
 
   tokens.issued_at = extractedIssueAt(tokens, accessTokenPayload, _idTokenPayload);
@@ -175,8 +212,9 @@ function _hideTokens(
       : tokens.issued_at + expireIn;
 
   let expiresAt: number;
-  const tokenRenewMode = (currentDatabaseElement.oidcConfiguration as OidcConfiguration)
-    .token_renew_mode;
+  const tokenRenewMode = currentDatabaseElement.resource
+    ? TokenRenewMode.access_token_invalid
+    : (currentDatabaseElement.oidcConfiguration as OidcConfiguration).token_renew_mode;
   if (tokenRenewMode === TokenRenewMode.access_token_invalid) {
     expiresAt = accessTokenExpiresAt;
   } else if (tokenRenewMode === TokenRenewMode.id_token_invalid) {
@@ -189,13 +227,63 @@ function _hideTokens(
   tokens.expiresAt = expiresAt;
   const nonce = currentDatabaseElement.nonce ? currentDatabaseElement.nonce.nonce : null;
   const { isValid, reason } = isTokensOidcValid(
-    tokens,
+    currentDatabaseElement.resource && !hasNewIdToken
+      ? { ...tokens, idTokenPayload: undefined }
+      : tokens,
     nonce as string,
     currentDatabaseElement.oidcServerConfiguration as OidcServerConfiguration,
   ); // TODO: Type assertion, could be null.
   if (!isValid) {
     throw Error(`Tokens are not OpenID valid, reason: ${reason}`);
   }
+  if (currentDatabaseElement.resource) {
+    if (
+      typeof tokens.access_token !== 'string' ||
+      !tokens.access_token ||
+      !Number.isFinite(expiresAt) ||
+      !Number.isFinite(tokens.issued_at) ||
+      (tokens.refresh_token != null &&
+        (typeof tokens.refresh_token !== 'string' || !tokens.refresh_token))
+    ) {
+      throw new Error('The provider did not return a usable resource token response.');
+    }
+    const resource = getResourceConfiguration(
+      currentDatabaseElement.oidcConfiguration?.resources,
+      currentDatabaseElement.resource,
+    );
+    tokens.scope ??=
+      currentDatabaseElement.requestedScope ??
+      resource.scope ??
+      currentDatabaseElement.oidcConfiguration?.scope;
+    secureTokens.scope = tokens.scope;
+    if (
+      resource.scope &&
+      !resource.scope
+        .split(/\s+/)
+        .filter(Boolean)
+        .every(scope => (tokens.scope ?? '').split(/\s+/).includes(scope))
+    ) {
+      throw new Error('The provider did not grant the required resource scopes.');
+    }
+    const parentSubject = currentDatabaseElement.parentConfiguration?.tokens?.idTokenPayload?.sub;
+    const subject = tokens.idTokenPayload?.sub ?? oldTokens?.idTokenPayload?.sub ?? parentSubject;
+    if (typeof parentSubject !== 'string' || subject !== parentSubject) {
+      throw new Error('Resource authorization must preserve the authenticated subject.');
+    }
+    if (
+      (accessTokenPayload?.iss !== undefined &&
+        accessTokenPayload.iss !== currentDatabaseElement.oidcServerConfiguration?.issuer) ||
+      (accessTokenPayload &&
+        resource.audiences &&
+        !resource.audiences.some(audience =>
+          (typeof accessTokenPayload.aud === 'string'
+            ? [accessTokenPayload.aud]
+            : (accessTokenPayload.aud ?? [])
+          ).includes(audience),
+        ))
+    )
+      throw new Error('Resource token issuer or configured audience does not match.');
+  }
 
   // When refresh_token is not rotated we reuse old refresh_token
   if (oldTokens != null && 'refresh_token' in oldTokens && !('refresh_token' in tokens)) {
@@ -210,26 +298,85 @@ function _hideTokens(
   }
 
   currentDatabaseElement.status = 'LOGGED_IN';
+  if (currentDatabaseElement.resource) {
+    const grant = currentDatabaseElement.refreshGrant ?? currentDatabaseElement;
+    const subject =
+      tokens.idTokenPayload?.sub ??
+      grant.tokens?.idTokenPayload?.sub ??
+      currentDatabaseElement.parentConfiguration?.tokens?.idTokenPayload?.sub;
+    if (typeof subject !== 'string')
+      throw new Error('Resource tokens require an authenticated OIDC subject.');
+    if (grant !== currentDatabaseElement && tokens.refresh_token && grant.tokens) {
+      grant.tokens.refresh_token = tokens.refresh_token;
+    }
+    const resourceContext = {
+      resource: currentDatabaseElement.resource,
+      issuer: currentDatabaseElement.oidcServerConfiguration!.issuer,
+      clientId: currentDatabaseElement.oidcConfiguration!.client_id!,
+      configurationName: currentDatabaseElement.configurationName.split('#')[0],
+      subject,
+      grantResource: grant.resource ?? null,
+    };
+    currentDatabaseElement.tokens!.resourceContext = resourceContext;
+    secureTokens.resourceContext = resourceContext;
+  }
   return secureTokens;
 }
 
 const demonstratingProofOfPossessionNonceResponseHeader = 'DPoP-Nonce';
-function hideTokens(currentDatabaseElement: OidcConfig) {
+function hideTokens(
+  currentDatabaseElement: OidcConfig,
+  isCurrent: () => boolean = () => true,
+  isGrantCurrent: () => boolean = isCurrent,
+  isAuthorizationCode = false,
+) {
   const configurationName = currentDatabaseElement.configurationName;
   return (response: Response) => {
     if (response.status !== 200) {
       return response;
     }
     const newHeaders = new Headers(response.headers);
-    if (response.headers.has(demonstratingProofOfPossessionNonceResponseHeader)) {
+    if (
+      response.headers.has(demonstratingProofOfPossessionNonceResponseHeader) &&
+      isGrantCurrent()
+    ) {
       currentDatabaseElement.demonstratingProofOfPossessionNonce = response.headers.get(
         demonstratingProofOfPossessionNonceResponseHeader,
       );
+      if (
+        currentDatabaseElement.refreshGrant &&
+        currentDatabaseElement.refreshGrant !== currentDatabaseElement
+      ) {
+        currentDatabaseElement.refreshGrant.demonstratingProofOfPossessionNonce =
+          currentDatabaseElement.demonstratingProofOfPossessionNonce;
+      }
       newHeaders.delete(demonstratingProofOfPossessionNonceResponseHeader);
     }
 
     return response.json().then<Response>((tokens: Tokens) => {
-      const secureTokens = _hideTokens(tokens, currentDatabaseElement, configurationName);
+      const grant = currentDatabaseElement.refreshGrant;
+      if (
+        currentDatabaseElement.resource &&
+        grant &&
+        isGrantCurrent() &&
+        grant.tokens &&
+        typeof tokens.refresh_token === 'string' &&
+        tokens.refresh_token &&
+        (grant !== currentDatabaseElement ||
+          tokens.refresh_token !==
+            currentDatabaseElement.parentConfiguration?.tokens?.refresh_token)
+      ) {
+        grant.tokens.refresh_token = tokens.refresh_token;
+      }
+      if (!isCurrent()) {
+        throw new Error('The token transaction was cleared before its response.');
+      }
+      const secureTokens = _hideTokens(
+        tokens,
+        currentDatabaseElement,
+        configurationName,
+        isAuthorizationCode,
+      );
       const body = JSON.stringify(secureTokens);
       return new Response(body, {
         status: response.status,

package/src/version.ts

@@ -1 +1 @@
-export default '7.29.7';
+export default '7.30.0';

package/dist/src/OidcServiceWorker.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=OidcServiceWorker.d.ts.map

package/dist/src/OidcServiceWorker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"OidcServiceWorker.d.ts","sourceRoot":"","sources":["../../src/OidcServiceWorker.ts"],"names":[],"mappings":""}

package/dist/src/__tests__/jwt.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=jwt.spec.d.ts.map

package/dist/src/__tests__/jwt.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.spec.d.ts","sourceRoot":"","sources":["../../../src/__tests__/jwt.spec.ts"],"names":[],"mappings":""}

package/dist/src/__tests__/oidcConfig.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=oidcConfig.spec.d.ts.map

package/dist/src/__tests__/oidcConfig.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidcConfig.spec.d.ts","sourceRoot":"","sources":["../../../src/__tests__/oidcConfig.spec.ts"],"names":[],"mappings":""}

package/dist/src/__tests__/protocol.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=protocol.spec.d.ts.map

package/dist/src/__tests__/protocol.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"protocol.spec.d.ts","sourceRoot":"","sources":["../../../src/__tests__/protocol.spec.ts"],"names":[],"mappings":""}

package/dist/src/constants.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,cAAc,0BAA0B,CAAC;AAC/C,QAAA,MAAM,oBAAoB,MAAM,CAAC;AAEjC,KAAK,SAAS,GAAG;IACf,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,QAAA,MAAM,KAAK,EAAE,SAKZ,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB,QAAQ,CAAC,gCAAgC,EAAE,MAAM,CAAC;IAClD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAEF,QAAA,MAAM,cAAc,EAAE,kBAIrB,CAAC;AAEF,QAAA,MAAM,yBAAyB,sCAAsC,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC"}

package/dist/src/crypto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/crypto.ts"],"names":[],"mappings":"AAEA,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,2BAQzC;AAED,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASjF"}

package/dist/src/dpop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../src/dpop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AASnD,eAAO,MAAM,oBAAoB,GAAI,eAAe,MAAM,EAAE,GAAG,aAAa,4EAa3E,CAAC;AAEF,eAAO,MAAM,gCAAgC,GAAI,eAAe,MAAM,EAAE,GAAG,aAAa,mBAUvF,CAAC"}

package/dist/src/jwt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/jwt.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,2CAA2C,EAAE,MAAM,SAAS,CAAC;AAiCtE,eAAO,MAAM,gBAAgB,GAAI,OAAO,UAAU,WAOjD,CAAC;AAUF,eAAO,MAAM,kDAAkD,EAAE,2CAc9D,CAAC;AAuEJ,eAAO,MAAM,GAAG;cAnEV,GAAG,MAEL,KAAK,GAAG,EACR,SAAS,GAAG,EACZ,QAAQ,GAAG,EACX,6CAA6C,2CAA2C,EACxF,sBAA0B;CA6DH,CAAC;AAqD5B,eAAO,MAAM,GAAG;oBAtBO,GAAG,MAAY,QAAG,EAAE,iBAAiB,mBAAmB;CAsB9C,CAAC;AAElC,eAAO,MAAM,gBAAgB,GAC1B,GAAG,GAAG,MAAY,sBAAsB,qBAAqB,GAAG,cAAc,iBAO9E,CAAC;AAEJ,eAAO,MAAM,8CAA8C,GACxD,GAAG,GAAG,MACN,6CAA6C,2CAA2C,MAClF,KAAK,GAAG,EAAE,0BAAe,EAAE,KAAK,MAAM,EAAE,iBAAiB,oBAuB/D,CAAC"}

package/dist/src/oidcConfig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidcConfig.d.ts","sourceRoot":"","sources":["../../src/oidcConfig.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAU,UAAU,EAA2B,cAAc,EAAE,MAAM,SAAS,CAAC;AAehG,QAAA,MAAM,mBAAmB,GAAI,UAAU,QAAQ,EAAE,eAAe,MAAM,KAAG,OAWxE,CAAC;AAUF,QAAA,MAAM,0BAA0B,GAC9B,UAAU,QAAQ,EAClB,eAAe,MAAM,EACrB,gBAAgB,cAAc,KAC7B,OAeF,CAAC;AAEF,QAAA,MAAM,0BAA0B,GAC9B,UAAU,QAAQ,EAClB,eAAe,MAAM,EACrB,gBAAgB,cAAc,KAC7B,OAmBF,CAAC;AAEF,QAAA,MAAM,6BAA6B,GAAI,UAAU,QAAQ,EAAE,KAAK,MAAM,KAAG,UAAU,EAWlF,CAAC;AAEF,OAAO,EACL,6BAA6B,IAAI,gCAAgC,EACjE,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,CAAC"}